This bug was originally reported against the anonymous calls
to the SamrChangePassword() MS-RPC function in combination
with the "username map script" smb.conf option (which is not
enabled by default).

After further investigation by Samba developers, it was
determined that the problem was much broader and impacts
remote printer and file share management as well. The root
cause is passing unfiltered user input provided via MS-RPC
calls to /bin/sh when invoking externals scripts defined
in smb.conf. However, unlike the "username map script"
vulnerability, the remote file and printer management scripts
require an authenticated user session.

The Samba Team always encourages users to run the latest
stable release as a defense against attacks. If this
is not immediately possible, administrators should read
the "Server Security" documentation found at

[url]http://www.samba.org/samba/docs/server_security.html[/url]

=======
Credits
=======

This vulnerability was discovered by an anonymous researcher
and reported to Samba developers by Joshua J. Drake, iDefense
Labs ([url]http://www.idefense.com/[/url]), as part of their Vulnerability
Contributor Program.